Experimental quantum key distribution over highly noisy channels 
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Error filtration is a method for encoding the quantum state of a single particle into a higher 
dimensional Hilbert space in such a way that it becomes less sensitive to phase noise. We exper- 
imentally demonstrate this method by distributing a secret key over an optical fiber whose noise 
level otherwise precludes secure quantum key distribution. By filtering out the phase noise, a bit 
error rate of 15.3% ± 0.1%, which is beyond the security limit, can be reduced to 10.6% ± 0.1%, 
thereby guaranteeing the cryptographic security. 

PACS numbers: 03.67.-a,03.65.-w 



One of the central results in quantum information is 
that errors can, in principle, be corrected |lj, |2|. This 
discovery transformed quantum information from an in- 
tellectual game into a field which could revolutionize the 
way we process information. Practical realizations of 
quantum error correcting codes are, however, extremely 
difficult because they require multiparticle interactions. 
A first experimental demonstration of quantum error cor- 
rection has recently been realized 3], but it is still very 
far from being usable in practical applications. An al- 
ternative method, called error filtration, allows errors to 
be filtered out during quantum communication, and can 
in contrast be easily implemented using present technol- 
ogy Q. The main idea of error filtration is to encode 
one qubit in a single particle within a Hilbert space of 
dimension greater than two. It is then possible to de- 
tect, with high probability, whether a phase error has 
occurred, and, if so, to discard the state. This quantum 
error detection scheme is less powerful than full error 
correction, but, for many applications such as quantum 
key distribution (QKD), discarding the state affected by 
phase noise is sufficient. The advantage of this method 
is that the encoding and decoding operations do not re- 
quire multiparticle interactions, hence they are relatively 
easy to implement by interferometric techniques. 

Here, we report on an experimental demonstration of 
error filtration. For a detailed theoretical introduction to 
the method, we refer to |4| where it is also shown that 
error filtration can be extended to the purification of en- 
tanglement affected by phase noise. Our experimental 
scheme is based on the fiber optics "plug and play" quan- 
tum cryptosystem 0, [|J and its extension to more than 
two dimensions presented in in the context of quantum 
computing. The interest of error filtration is illustrated 
by performing QKD over a noisy quantum communica- 
tion channel with so much noise that a secure BB84 pro- 
tocol cannot be realized. It is known that if the bit error 
rate (BER) exceeds 14.6%, then a simple cloning attack 



makes the BB84 protocol insecure. On the other hand, 
if the BER is lower than 11.0%, then the BB84 proto- 
col is provably secure. Between the two boundaries lies 
agray zone where the security of BB84 is unknown, see 
[8J for a review. In our experiment, we consider an error 
prone QKD scheme with a BER = 15.3% ± 0.1%, which 
is therefore insecure. Using error filtration, the BER is 
brought down to 10.6% ± 0.1% so that QKD is rendered 
secure. Nevertheless, the present work will probably not 
have immediate practical applications in QKD because 
the main limitation at present is absorption rather than 
phase noise. In order to extend QKD much beyond the 
present limit of 100 km, new techniques such as quantum 
repeaters will have to be used (see 0, [MM for recent pro- 
posals) . Then, the contribution of phase noise will prob- 
ably become significant and error filtration could provide 
a simple solution. Finally, note that it was realized pre- 
viously that the use of higher dimensional systems can 
increase the resistance of QKD to noise 01 • We will dis- 
cuss the advantages of error filtration over these previous 
methods in what follows. 

Our experimental error filtration setup works with at- 
tenuated coherent states traveling in localized time bins 
in optical fibers (standard SMF-28), see Fig.Q] Bob uses 
a laser diode at 1.55 /im to produce a 3-ns light pulse. 
The pulse is attenuated by an optical attenuator (Agilent 
8156A), and then split by a first 50/50 coupler (Ci) to 
produce two pulses. These pulses impinge on the input 
ports of a polarization beamsplitter (PBS) with a time 
delay A = 60 ns. Their polarizations are rotated, using 
polarization controllers, so that the two pulses exit by the 
same port of the PBS. Next, the two pulses are processed 
through an unbalanced Mach-Zehndcr (MZ) interferom- 
eter C2C3 with a path length difference equivalent to 
2A. This produces four emerging pulses traveling down a 
900-ns delay line (representing the noisy communication 
channel). Then, at Alice's site, the pulses are reflected 
back by a Faraday mirror. The use of a Faraday mirror 
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FIG. 1: Fiber optics QKD setup with error filtration. 



makes the setup insensitive to birefringence in the de- 
lay line. Alice may modify the phases of the four pulses 
using a phase modulator (4>a) (Trilink) controlled by a 
pattern generator (Agilent 81110A). When they reach 
Bob's site, the pulses pass through the MZ interferom- 
eter and interfere at the C2 coupler, which, as we shall 
show, realizes error filtration. The six emerging pulses 
then travel trough Bob's phase modulator (4>b) (Trilink) 
and the PBS to the coupler Ci, where they interfere and 
are sent to a single-photon detector (id Quantique id200) 
via a circulator. The detector was gated by a pattern 
generator during a 5-ns window around the arrival time 
of the central pulse. Its output was registered using a 
time-to-digital delay converter (ACAM-GP1) connected 
to a computer. All electronic components were triggered 
by a pulse generator (Standford Research Inc. DG355). 
In order to maximize the interference visibilities, polar- 
ization controllers were introduced in the long arm of 
the MZ interferometer and in front of the polarization- 
sensitive phase modulators. Once optimized, the setup 
was stable for days. 

Before discussing error filtration, let us first consider 
the case where the MZ interferometer C2C3 is absent. 
Then our setup is identical to the plug-and-play quantum 
cryptography setup [f| . The wavefunction describing the 
state after Alice has encoded her phase 4>a can be written 
as -^(|i ) ff — e l ^ A \ti) v ), where the subscripts H and 
V represent the polarization states while the subscripts 
and 1 represent the relative delay of time bin i, i.e. 
ti = i ■ A. In the BB84 protocol, the phase tpA must 
be chosen randomly in {0, ^, 7r, ^}. The (—1) phase in 
front of \ti)v takes into account the conventional relative 
phase of 7r/2 between the reflected and transmitted light 
at coupler Ci and at the PBS. The state leaving Alice's 
site thus reads 



|V> = ^[Mv- e #A |fl>H] 



(1) 



where the polarizations have been interchanged because 
of the Faraday mirror. 



Intrinsic noise in the plug-and-play QKD scheme is ac- 
tually very low, see [f| , so that in our experiment we had 
to simulate the noisy channel by making Alice's phase 
modulator imperfect. This was achieved by electronically 
combining the signal from the pattern generator with the 
output of a function generator (Agilent 33250A) produc- 
ing gaussian electronic noise with an adjustable ampli- 
tude and a 50-MHz 3dB-bandwidth. Since the time bins 
are separated by 60 ns, the phase noise in the successive 
time bins can be considered as independent. The state 
produced by Alice is thus 
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where the tfi's are independent random phases drawn 
from a gaussian probability distribution P{^i) — 
-y==f exp (— ipf /(2er 2 )) of tunable variance a 1 . The 
density matrix obtained by averaging over the random 
phases is p = e~ a ~\i/j)(-i(,>\ + (1 — e~ CT ")l/2, so that phase 
noise amounts to the admixture of isotropic noise. In 
terms of bit error rate, this noise level thus corresponds 
to BER = 1 - (ip\p\ip) = (1 - e- a2 )/2. 

The two pulses travel back to Bob, who performs a 
measurement in the -±=(\to)v T e" l ^ B \ti)fi) basis by ap- 
plying the phase 4>b <= {0, ■§}■ Bob's detector is con- 
nected to either output port Pi or P2. The probability 
for Bob to detect a count (assuming a perfect detector) 



is \ ± § cos(v?i - (fo 



bs) where the sign depends 



on which output port is used. The visibility of the inter- 
ference fringes measured by Bob is 



V 



(3) 



The measured values of V agree well with this prediction, 
see lower curve in Fig. [5] Note that the visibility is related 
to the bit error rate via BER = (1 — V)/2. 

In order to carry out error filtration, we use the ad- 
ditional MZ interferometer C2C3. Each pulse exiting 
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FIG. 2: Visibility as a function of the standard deviation of 
the noise signal produced by the function generator. The pro- 
portionality factor between the x-axis and a was determined 
by fitting the experimental data without filtration with Eq. 
©. The squares (full circles) represent the measured visibil- 
ities without (with) filtration, while the curves are the the- 
oretical predictions of Eqs. Q and (JgJ. The open circles 
show filtration in the single-photon regime. The inset magni- 
fies the data in the region where one passes from an insecure 
{V < 70.7%) to a secure (V > 78.0%) QKD protocol. The 
criss-crossed area shows that a visibility that is either inse- 
cure or of unknown security can be increased to a provably 
secure one. By making the statistics over 200,000 runs, the 
error bars were made smaller than the plotting points. 



from the PBS is split into two pulses by the MZ in- 
terferometer according to |io)if — * (Ko)ff — |*2)ff ) /2, 
\t\)v -> (\h)v - \t 3 ) v )/2. The factor 1/2 takes into 
account that half of the intensity is lost at coupler C3. 
After Alice has encoded her phase (f>A and the pulses have 
been reflected by the Faraday mirror, the state becomes 
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(\ti} H -\h) H )]. (4) 



This is formally identical to the BB84 protocol since Alice 
effectively uses the 2-dimensional space S spanned by 
{\to)v — \h)v) and (|£i)// — ^h)- The time bins t 2 and 
£3 are just replica of the time bins irj and t\, respectively. 
Then, because of the noise, the four pulses get random 
phases tpo, tp±, tp 2 and 933, respectively. The state that 
Alice sends back to Bob is thus 
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[e^\t )v - e^\t 2 ), 



only has a probability 1/2 of taking the right path [l2| . 
When time bins irj and ti follow the long path in the MZ 
interferometer while time bins t 2 and t 3 follow the short 
path, the time bins t and t\ then interfere respectively 
with t 2 and t% at coupler C 2 and error filtration occurs. 
The component of the resulting quantum state into the 
time window (t 2 ,t 3 ) is the 2-dimensional state 

[ (e ^o + ^ )\t 2 ) v - e »A ( e «Pi + e «P. )|f 3 ) H ] , (6) 



4a/2 

where the normalization takes into account the losses at 
the unconnected pigtail at coupler C 2 . The interference 
of phase factors in the amplitudes is responsible for the 
error filtration. All other optical paths do not participate 
to error filtration, as we can see by considering the full 
state entering Bob's phase modulator 



e ivo \t ) v - e^+^lt^H- (e^° + e l ^)\t 2 ) v 



4^ 



+e** A (e^ 1 + e^ 3 ) \t 3 ) H + e^ 2 \t 4 ) v - e ^ A+ ^ \t 5 ) H )] .(7) 

Indeed, the time bins (to, t\, t^, tg) contain information 
about <pA, but phase errors are not filtered out since 
(in,ii) and (£4, £5) have the same structure as Eq. (0). 

Bob completes his measurement by encoding the phase 
4>b and letting the time bins interfere at coupler Ci. In 
the time window (t 2 ,ts), this realizes a measurement in 
the -^(\t 2 } v =F e^ 1 ^ 3 basis. In fact, there will be 
three time bins t' , t' 2 , and t\ at the output of coupler 
Ci. Time bin t' 2 corresponds to the measurement of the 
filtered state, Eq. ©, whereas time bins t' and t' 4 cor- 
respond to the measurement of the unfiltered time bins 
(to, ii) and (t^, t 5 ), respectively. Assuming that the noise 
affecting the different time bins is independent, the visi- 
bility of the interference fringes in the time bin t' 2 is 



V = 2/(l + e a "). 



(8) 



(e^Mff-e^'lis)*)]. 

(5) 

It now belongs to the full space spanned by |£o)v, IMv, 
\t 3 )n and \t±)H, since the phase noise has taken it out 
of the space S. The idea of error filtration is for Bob 
to project the state back onto S in order to selectively 
enhance the visibility. This projection is realized by the 
MZ interferometer. It succeeds with probability 1/2 in 
our implementation because at coupler C3, each pulse 



Thus, filtration effects an increase of visibility at the ex- 
pense of a decreased intensity (the information is lost 
when the photon ends up in the unused port of C 2 or 
in the time bins t' or t'^). The generalization to the 
case where Alice uses 2iV time bins to encode her qubit 
is immediate. One finds that the visibility becomes 
V 2N = N/(N - 1 + e' 7 '), see 0. 

The measured average visibilities are plotted in Fig. |3 
as a function of the phase noise standard deviation in 
the case where Alice applies 4>a — and Bob measures 
the output port Pi. Without noise, the maximal visibil- 
ities exceeded 99%. With unfiltered noise (lower curve), 
the visibility decreases exponentially with the amount of 
noise in accordance with Eq. 0. The filtration achieved 
by our setup (upper curve) is also very close to the theo- 
retical prediction of Eq. (jSJ. Visibilities in the range from 
65% to 78% are enhanced, by filtration, to the range from 
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78% to 85%, see inset of Fig. EJ Noting that the secu- 
rity threshold BER < 11.0% translates into V > 78.0% 
while the insecurity threshold BER > 14.6% corresponds 
to V < 70.7%, we conclude that our setup transforms 
a BB84 protocol which is insecure (or of unknown se- 
curity) into a provably secure one. Note that the visi- 
bilities were also tested for the other possible values of 
4>A = 7r/2, 7r, 37r/2 used in the BB84 protocol and for both 
ports Pi and P2. The visibilities all exceeded 97.2% in 
the case where no noise is added. The lowest visibilities 
are associated with the cases where Alice and Bob choose 
the {§, basis since then both parties must apply a 
potential to their polarization-sensitive phase modulator 
which makes the setup noisier. 

In Figure |21 the visibilities were measured in a regime 
where the state, when it leaves Alice's site, contains ap- 
proximately 120 photons. In this way, the dark counts 
of the detector are negligible. To consider a realistic 
QKD implementation, we also ran the experiment in the 
single-photon regime, where the quantum state sent by 
Alice back to Bob contains approximately 0.8 photons 
per pulse. The difficulty in this case is that dark counts 
become very important (they give a raw error rate of 
about 30%) because we use 3-ns pulses 0. Neverthe- 
less, we were able to show in this regime that a visibility 
of 69.4% ±0.2% in the absence of filtration can be turned 
into 78.8% ±0.2% by filtration, where the statistical er- 
ror was calculated for a 95% confidence level, see open 
circles in Fig. |21 These visibilities are averaged over all 
four choices of <Pa and for the two output ports P\ and 
P2, so they are the relevant quantities for characterizing 
a QKD scheme. This averaging explains why these points 
lie slightly off the curves in Fig. [21 Note that in QKD 
the errors due to the dark counts can in principle be re- 
moved using error correction codes without altering the 
security, although in practice this is probably impossible 
for the high level of dark counts we have here. 

We conclude by comparing this method with other 
QKD schemes that use higher dimensional systems . 
The noise model in both cases is the same: a d- 
dimensional state \ip) entering the communication chan- 
nel exits as p = e~ a \i))(ip\ + (1 — e ~ CT )$-/d. This makes 
the comparison meaningful. The QKD schemes based on 
sets of mutually unbiased bases considered in [ll| can 
only tolerate a noise level up to e - ' 7 <l/2. This is be- 
cause when e~ a = 1/2, there is a simple attack in which 
the eavesdropper (Eve) does not modify the state with 
probability 1/2, while, with probability 1/2, she keeps 
the state and sends a random one instead. In contrast, 
error filtration can tolerate arbitrarily high levels of noise 
if the dimensionality d of the Hilbert space is sufficiently 
large since the visibility Vd tends to 1 for large d and 
fixed e~ a . The reason why the above attack no longer 
works in the case of error filtration is that when Eve re- 
places the quantum state by a random one, the filtration 
preferentially removes the corresponding noisy term. In 



other words, the noise is replaced by a higher effective 
loss. Nevertheless, this also means that a QKD scheme 
using error filtration can be vulnerable to attacks which 
exploit loss. For instance, if Alice sends attenuated co- 
herent states. Eve could use a photon-number splitting 
attack, see [8| and references therein. In fact, our setup 
would probably be insecure against such attacks since we 
used attenuated coherent states with 0.8 photons on av- 
erage and were very close to the limit of provably secure 
QKD. This is not a fundamental problem and could be 
remedied by further attenuating the states or by using 
better approximations of single-photon sources. 

In summary, the present experiment demonstrates the 
optical part of a quantum key distribution scheme which 
can operate with a phase-noise level that is too high for a 
standard implementation of the BB84 to be secure. This 
demonstrates the power and simplicity of error filtration 
as a practical method for circumventing phase noise in 
quantum communication. 
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